Printable View
Hi,
I was wondering what the best way to protect a network against the MSBlaster worms are other than patching all the boxes... I ask this because I was wondering what the school I am attending would do... Is it as simple as not allowing traffic over port 135? not allowing TFTP??? Those are a few things that they have mentioned about doing...
Thank you!
Block 135 inbound and tftp outbound and you should be fine.
but it is also a good idea to patch the machines, u never know....maybe someone inside ur network might brink the virus on a disk and have it infect internally.
We were protected at the perimeter (firewalled the known ports it uses) however, the virus did get inside through other means. All unpatched boxes were infected.
I'd say take both recommendations and use it as a tiered strategy. If our admins would have done so, my life would have been much easier last week. ;)
--TH13
I find that using a Macintosh Powerbook does a pretty good job also :D
We blocked tftp and MSRPC at our perimeter and that worked for a good while; however, should have paid more attention to our backdoors (dialup/vpn). That opened the door before we could close it again...of course now we are and have blocked/monitored there as well and aside from the occasionaly schmuck bringing in infected laptops things have been pretty quiet...
Guess the point is, even with a good hard perimeter...a soft gooy center still leaves you open to other threats, it is just a matter of time (be it a backdoor, people plugging up other equipment, etc). Best thing you can do is make sure you are not vulnerable by using a scanner (Retina has one that is free for this vulnerability and I think the SANS folks released one too) and to patch up any vulnerable machines.
/nebulus
Thats something that no one ever thinks about. You put up a concrete wall but it doesn't do anything when you leave the window open.Quote:
Originally posted here by nebulus200
Guess the point is, even with a good hard perimeter...a soft gooy center still leaves you open to other threats, it is just a matter of time (be it a backdoor, people plugging up other equipment, etc). Best thing you can do is make sure you are not vulnerable by using a scanner (Retina has one that is free for this vulnerability and I think the SANS folks released one too) and to patch up any vulnerable machines.
A Linux or BSD box also works well. There is one XP box on my network and thats it, it has patches installed, a firewall, Anti virii....Should be fine.Quote:
Originally posted here by souleman
I find that using a Macintosh Powerbook does a pretty good job also :D
Quote:
Originally posted here by gore
A Linux or BSD box also works well. There is one XP box on my network and thats it, it has patches installed, a firewall, Anti virii....Should be fine.
Welp, I have over 60000 users on my network with about 59500 of them being not the sharpest toosl in the shed, so you can imagine what I have had to deal with :/
/nebulus
I have over 999999999 users on my netowrk and it is hard too :-p
Just kidding, Felt Like I had to say something stupid.
Close TCP port 135 and also other NetBIOS ports (135-139, 445 and 593)
- Monitor all activities on TCP port 4444 and UDP port 69
- Download and apply Microsoft’s Patch
- Download and run the Blaster Removal Tool from Symantec to clean your system
===============
- Microsoft’s patch: http://www.microsoft.com/technet/tre...letin/MS03-026
- Blaster removal tool:
http://securityresponse.symantec.com...oval.tool.html
- Microsoft Security Bulletin – DCOM RPC Vulnerability: http://www.microsoft.com/technet/tre...n/MS03-026.asp
- Microsoft RPC Model: http://msdn.microsoft.com/library/de..._rpc_model.asp
Security Patches for M$BLAST
------------------------------------------
For Windows NT Server 4.0 and WorkStations
http://download.microsoft.com/downlo...a/Q823980i.EXE
Windows NT Server Terminal Service Editions
http://download.microsoft.com/downlo...9/Q823980i.EXE
Windows 2000(Server, Professional, DataCenter)
http://download.microsoft.com/downlo...80-x86-ENU.exe
Windows XP(32 Bit)
http://download.microsoft.com/downlo...80-x86-ENU.exe
Windows XP(64Bit.For Intel Itanium Based Systems)
http://download.microsoft.com/downlo...0-ia64-ENU.exe
Windows 2003(32 Bit.Server,Enterprise,DataCenter,Web)
http://download.microsoft.com/downlo...80-x86-ENU.exe
Windows 2003(64 Bit.For Intel Itanium Based Systems)
http://download.microsoft.com/downlo...0-ia64-ENU.exe
Enable a Internet Connections FireWall in Windows XP Professional, Windows XP Home Editions and Windows 2003 (All Editions)
Windows XP Pro
http://www.microsoft.com/windowsxp/p...orking/icf.asp
Windows XP Home
http://www.microsoft.com/WindowsXP/h...omenet/icf.asp
Windows 2003 All Editions
http://www.microsoft.com/technet/tre...e_firewall.asp
Well between patches to those system I could and I started with the servers, I found the firewall settings at least mine only ports open were those that I know we use, and also pushing the latest anti virus updates to all systems that last week was covered. Been at it to long patches and anti virus pushed to every computer. Only thing I had to deal with were the pop ups saying an email Sobig.F was caught and people thinking oops I'm infected but it was placed in a harmless area and removed. Always remember security is as strong as your most lame user and usually it is one of the biggies of the company :)
Having dealt with the same crap as nebulus and TH13, I would reccomend the following:
Secure perimeter
Managed and up to date Anti-virus software
Centralized patch management and deployment
-Maestr0
I remebered to secure my VPN but missed a dial-up(Doh!), but was nearly up to date on all patches and most boxes so just had to play a little tag with Blaster and Welchia. It was still a pain in the ass.
I think that if people just applied the patches for Windoze the blaster worm wouldn't have been so prolific. You must also have firewalls and AV applications.
JMO
::coffee::
ccKid
up to date antivirus definitions and patch management are very important especially when you have lots of users who know nothing. lots of people tend to forget the patch management for the end users. patching the servers and making sure the antivirus is updated on servers and securin the firewall is useless once some idiot inside lets it loose on your network when lots of the end users are not protected on their own system.
Now with most users having notebooks and working from all over the place it gets almost unmanageable with remote tools to deploy patches and updates.
I have that problem trying to manage users systems even with the remote tools i have to push updates and patches to the users.
A lil LART would help you out greatly. :) Make them FEAR calling you.Quote:
Originally posted here by nebulus200
Welp, I have over 60000 users on my network with about 59500 of them being not the sharpest toosl in the shed, so you can imagine what I have had to deal with :/
/nebulus
Hi guys,
If the network is affected by welchia worm & i use removal program from symentac, then after removing worm will it stop to send ICMP packets to other pcs/network or I have to do anything else??
Thanks
viruss
well if you have a good antivirus that should pick it up if not, it is a good idea install the patch, an easier way of doing this is to put it in the logon script of a privelidged account like sysuser1 or something like that and log into all the machines. that I think would be the easiest way
hope I was of good help,
c0bra
virus removal it's not enough, if you didn't apply any patch for it, it'll keep on infecting your system, better be on a look out for patches etc,Quote:
Originally posted here by viruss
Hi guys,
If the network is affected by welchia worm & i use removal program from symentac, then after removing worm will it stop to send ICMP packets to other pcs/network or I have to do anything else??
Thanks
viruss
as what others have said try to secure your point of entry, firewall/router, VPN servers and RAS servers. for cisco routers, you can go to cisco.com and check for access-list that will help ya thwart attacks, check microsoft for OS patches and check antivirus site for patches for OS vulnerabiliy as well
I haven't seen anyone mention Software Update Services yet, so here's a link ...
It's free, easy to set up and makes managing a crappy Windoze network so much easier.
Almost everything mentioned in this string is reactive in nature. IMHO, in order to effectively combat the threats and vulnerabilities of the future, we (as a security community) need to be more proactive. Yes, blocking ports and patching machines is important, but the zero-day exploits of the future may not allow us to do that. With the potential for the exploit to use emerging practices, such as embedded polymorphic coding engines (the worm, virus, etc. will not look the same way twice), the use of anomaly or behavioral-based protective measures need to be considered. Again, my opinion, signature-based protective measures will be obsolete in a couple of years, including current AV products.
I'm not endorsing any products here, just extending my experience. During the Blaster outbreak, I had laptops installed with a variety of firewall and behavioral/anomaly analysis software, Sygate, ZoneAlarm, Symantec, Cisco Security Agent (formerly Okena), and ISS Desktop Protector (formerly BlackICE). Although all of the products could have prevented the infection, due to business requirements within the company, certain ports had to be open to facilitate business communication (e.g., 135) - only the behavioral-based products prevented the infection, Cisco and ISS. The version of the products used were produced in March 2003, well before the MSRPC exploit was revealed by MS. No updates or changes to the installations were made. The products blocked the worm based on its behavior and what it was attempting to do. After doing some research, I found out these products were pretty successful in blocking the most (if not all) of the problematic infections over the past year or so. Although some of these products can be pricey, how much does it cost you or your company to address these problems in the first 24-48 hours? Based on the numbers I have seen, one major infection would probably cover the cost of these products for the first year or two...
I was pretty impressed with the performance of these products - I just wanted to pass it along as an ounce of preventive medicine...
~aberration~